CVE-2026-4558
Published: 22 March 2026
Description
A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The attack may be launched remotely. The exploit has…
more
been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing untrusted inputs such as configApSsid, configApPassphrase, srpLogin, and srpPassword before processing in SmartConnect.lua.
Remediates the specific command injection flaw in the Linksys MR9600 firmware version 2.0.6.206937 by identifying, reporting, and applying patches or fixes promptly.
Detects the CVE-2026-4558 vulnerability through regular scanning of the router firmware and hosted applications, enabling timely remediation to block exploitation.
Security SummaryAI
CVE-2026-4558 is an OS command injection vulnerability in the smartConnectConfigure function within the SmartConnect.lua file of the Linksys MR9600 router running firmware version 2.0.6.206937. The flaw arises from improper handling of the arguments configApSsid, configApPassphrase, srpLogin, and srpPassword, allowing malicious input to execute arbitrary operating system commands. It is classified under CWE-77 (Command Injection) and CWE-78 (OS Command Injection), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
Attackers with low privileges (PR:L), such as authenticated users on the device, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling full system compromise such as executing arbitrary commands, potentially leading to router takeover, data theft, or further network pivoting.
Advisories from VulDB (ctiid.352385, id.352385, submit.775036) and a GitHub issue (utmost3/cve/issues/1) detail the vulnerability and confirm that a public exploit is available for use. The vendor, Linksys, was notified early but has not responded or issued any patches, leaving affected devices unmitigated as per available references.
Notable context includes the published exploit, which increases the risk of real-world attacks against unpatched Linksys MR9600 routers on this firmware version. No evidence of widespread exploitation in the wild is reported in the provided data.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability directly enables arbitrary command execution via Unix Shell (T1059.004) on the router's underlying OS and exploitation of the remote management service (T1210).